CVE-2018-3284: MariaDB 10.2.19 CVE-2018-3282: MariaDB 5.5.62, MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3277: MariaDB 10.2.19 CVE-2018-3251: MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3200: MariaDB 10.2.19 CVE-2018-3185: MariaDB 10.2.19 CVE-2018-3174: MariaDB 5.5.62, MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3173: MariaDB 10.2.19 CVE-2018-3162: MariaDB 10.2.19 CVE-2018-3156: MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3143: MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37
@ Arches, please test and mark stable. The test suite should pass following the official instructions. Local timeouts may be expected on resource starved machines. (each test thread can spawn up to 4 server instances) Target keywords: =dev-db/mariadb-10.0.37 alpha amd64 arm ia64 ppc ppc64 x86 =dev-db/mariadb-10.1.37 alpha amd64 arm ia64 ppc ppc64 x86 # Official test instructions: # USE='extraengine perl server' \ # FEATURES='test userpriv -usersandbox' \ # ebuild mariadb-10.0.37.ebuild \ # digest clean package # Parallel testing is enabled, auto will try to detect number of cores # You may set this by hand. # The default maximum is 8 unless MTR_MAX_PARALLEL is increased export MTR_PARALLEL="${MTR_PARALLEL:-auto}"
Updated list to include 10.3.11. These are the versions where the vulnerability is fixed in a series. Unlisted series are not affected. CVE-2018-3284: MariaDB 10.3.11, MariaDB 10.2.19 CVE-2018-3282: MariaDB 5.5.62, MariaDB 10.3.11, MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3277: MariaDB 10.3.11, MariaDB 10.2.19 CVE-2018-3251: MariaDB 10.3.11, MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3200: MariaDB 10.3.11, MariaDB 10.2.19 CVE-2018-3185: MariaDB 10.3.11, MariaDB 10.2.19 CVE-2018-3174: MariaDB 5.5.62, MariaDB 10.3.11, MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3173: MariaDB 10.3.11, MariaDB 10.2.19 CVE-2018-3162: MariaDB 10.3.11, MariaDB 10.2.19 CVE-2018-3156: MariaDB 10.3.11, MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37 CVE-2018-3143: MariaDB 10.3.11, MariaDB 10.2.19, MariaDB 10.1.37, MariaDB 10.0.37
x86 stable
amd64 stable
arm stable
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=31e42179dcfdd7ed47eea22a11fac9cb8fb1346b commit 31e42179dcfdd7ed47eea22a11fac9cb8fb1346b Author: Tobias Klausmann <klausman@gentoo.org> AuthorDate: 2018-11-28 16:04:23 +0000 Commit: Tobias Klausmann <klausman@gentoo.org> CommitDate: 2018-11-28 16:04:38 +0000 dev-db/mariadb-10.0.37-r0: alpha stable Bug: http://bugs.gentoo.org/670388 Signed-off-by: Tobias Klausmann <klausman@gentoo.org> dev-db/mariadb/mariadb-10.0.37.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
ia64 stable
alpha stable
dev-db/mariadb-10.0.37 removed from stable list as 10.0 is obsolete and due to be removed
ppc stable
ppc64 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6f3c8590c1c8bb857c79d1b06c638aed58c64b92 commit 6f3c8590c1c8bb857c79d1b06c638aed58c64b92 Author: Brian Evans <grknight@gentoo.org> AuthorDate: 2019-07-02 12:27:37 +0000 Commit: Brian Evans <grknight@gentoo.org> CommitDate: 2019-07-02 12:27:37 +0000 dev-db/mariadb: Clean up old and vulnerable versions Bug: https://bugs.gentoo.org/679024 Bug: https://bugs.gentoo.org/670388 Package-Manager: Portage-2.3.68, Repoman-2.3.16 Signed-off-by: Brian Evans <grknight@gentoo.org> dev-db/mariadb/Manifest | 7 - dev-db/mariadb/mariadb-10.1.34.ebuild | 887 ------------------------------- dev-db/mariadb/mariadb-10.1.37.ebuild | 887 ------------------------------- dev-db/mariadb/mariadb-10.2.24.ebuild | 972 --------------------------------- dev-db/mariadb/mariadb-10.3.13.ebuild | 973 --------------------------------- dev-db/mariadb/mariadb-10.3.15.ebuild | 974 ---------------------------------- dev-db/mariadb/mariadb-5.5.63.ebuild | 831 ----------------------------- 7 files changed, 5531 deletions(-)
This issue was resolved and addressed in GLSA 201908-24 at https://security.gentoo.org/glsa/201908-24 by GLSA coordinator Aaron Bauman (b-man).
